Apologies if some of these questions have already been addressed. Some of the threads I searched to answer my own questions were similar but closed for followup.

I'm replacing an older Apple Extreme Router with a 2-unit deco x55 system, attached to an older AT&T U-Verse Fiber modem / router for better whole house coverage. I'd like to configure my network as follows. (This is similar to my current configuration with only a primary Apple Router.)

I currently have both WiFi bands on the AT&T router turned off and IP Passthru enabled. I was then able to use the apple router's features for DHCP, NAT and other firewall functions. My apple router had a steady message that it had a private IP address on the WAN port (assigned by the AT&T gateway -- 192.168.x.xxx) ) and was connected to the gateway which was also using NAT. It recommended changing my apple router to bridge mode (turning off DHCP and NAT). I was told my AT&T at set up (about 5 years ago) to ignore this and i've not had any issues since nothing else is connected directly or wirelessly to the Gateway. (The private address space / addresses used by the apple router was in the 10.0.1.xx range.)

So my questions are:

1/ can I just swap out the apple router, activate and ethernet cable connect the new deco router to the same Gateway LAN port (plus the second deco to the primary via ethernet cable) and NOT have to make any changes to either the AT&T gateway or the deco routers? (Obviously, the deco will assign new, private IP addresses to all devices within my home.) I would then expect the deco to perform the DHCP, NAT and point to the appropriate DNS internet servers. This would be my preference as I can then rely on the new deco routers for upgraded firmware, security, privacy, etc.

If not, what would you recommend while still allowing me to somewhat independent of whatever AT&T is doing on the gateway and via their app (which i don't use to manage my current network?

2/ the gateway also has a firewall feature. Is there any reason to disable that if i also want to take advantage of my deco firewall?

3/ trivial question, but setting up a separate network for my IoT devices (which include several alexa speakers / command units plus tp-link smart outlet modules, cameras) basically establishes s second SSID wireless network. To use the KASA app on my phone I would then have to switch to this dedicated network each time, correct?

thank you in advance!

     . . . john